This is Linux specific:
A hotplug event handler will register with the kernel to receive hotplug events either over a netlink socket or by echoing its path to
/proc/sys/kernel/hotplug. It will then receive information over the socket (netlink) or via being launched with environment variables (/proc.../hotplug).
udev is this handler. When
udev gets an event, it proceeds through its rules, and processes ones that match. The rules can include loading kernel modules, naming the device, launching programs, and more.
If you want to see exactly what udev might see, you can write a short program to listen to the netlink socket, or you can do this:
Then give the file execute permissions and echo the path to
/proc/sys/kernel/hotplug. Insert and remove some devices and check the log.